„We completed the implementation of the GDPR a couple of years ago."
Are you sure about that?
Article 89 GDPR
Safeguards and exceptions applicable to processing for archival purposes in the public interest, for scientific or historical research purposes or for statistical purposes
1. Processing for archival purposes in the public interest, for scientific or historical research, or for statistical purposes shall be subject to appropriate safeguards for the rights and freedoms of the data subject in accordance with this Regulation. These safeguards consist of implementing technical and organizational measures to ensure respect for the principle of data minimization. These measures may also include pseudonymization of the data insofar as it allows the above objectives to be realized. If these purposes can be achieved by further processing of data that do not or no longer allow the identification of the data subject, the purposes must be achieved in this way.
2. Where personal data are processed for scientific or historical research purposes or for statistical purposes, Union law or the law of a Member State may provide for exceptions to the rights referred to in Article 15, 16, 18, and 21, subject to the conditions and safeguards referred to in paragraph 1 of this Article, if those rights are likely to render impossible or seriously impair the achievement of those specific purposes, and if such exceptions are necessary for the achievement of those purposes.
P: 156
3. Where personal data are processed for archiving purposes in the public interest, Union law or the law of a Member State may provide for exceptions to the rights referred to in Articles 15, 16, 18, 19, 20, and 21, subject to the conditions and safeguards referred to in paragraph 1 of this Article, if those rights are likely to render impossible or seriously impair the achievement of those specific purposes, and if such exceptions are necessary for the achievement of those purposes.
4. If the processing referred to in paragraphs 2 and 3 serves another purpose at the same time, the aforementioned exceptions apply only to processing for the purposes referred to in those paragraphs.
